chore(asset): add postgres bootstrap and pg_ident template

Idempotent SQL for role and database creation, split between the
postgres-database scope (bootstrap.sql) and the moments-database
scope (bootstrap-moments.sql), since CREATE DATABASE can't run
inside a DO block or transaction.

Roles:
  moments_rw — owner of the moments database; runs migrations
               and writes events from moments-worker.
  moments_ro — read-only; consumed by moments-api.

The pg_ident template is rendered per-host by deploy.sh once it
lands; one (host, role) mapping per file. Reload required on both
magrathea and frankie after install — pg_ident is not replicated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

asset/postgres/ident.conf.tmpl

@@ -0,0 +1,11 @@
+# moments — pg_ident.conf.d drop-in template
+# Rendered by script/deploy.sh per host based on manifest.yml.
+# Install path: /var/lib/pgsql/18/data/pg_ident.conf.d/{{HOST_FQDN}}.conf
+# Apply with: sudo systemctl reload postgresql-18 — on BOTH magrathea
+# (primary) and frankie (standby) so failover doesn't lock the app out.
+#
+# One line per (host, role) mapping. A host that runs both moments-api
+# and moments-worker will have two lines (one for moments_ro, one for
+# moments_rw).
+
+cert_cn {{HOST_FQDN}} {{DB_ROLE}}